lacework-global-91
Encrypt Redshift Clusters
Description
Best practices recommend encrypting an AWS Redshift cluster with a customer-managed Key Management Service (KMS) key.
Remediation
Encrypt an AWS Redshift cluster during creation.
- Log in to the AWS Management Console.
- If encrypting using an KMS key and the KMS key does not exist, create the KMS key.
- Click Services.
- Click Key Management Service.
- Click Create a key.
- Expand Advanced options.
- Select the KMS option.
- Fill in applicable KMS fields.
- Click Finish.
- Click Services.
- Click Amazon Redshift.
- Click Create cluster.
- Toggle Use defaults under Additional configurations to change the default settings.
- Expand Database configurations.
- Under Encryption, select Use AWS Key Management Service (AWS KMS).
- Select Use key from current account, and select a customer-managed KMS key, or select Use key from different account, and enter a customer-managed KMS key Amazon Resource Name (ARN).
- Fill in applicable Redshift cluster fields.
- Click Create cluster.